Snatch

 

wants-u?,

 

(a W:
DEPARTMENT OF HEALTH 8: SERVICES OFFICE OF THE SECRETARY
Voice - {214) 757-4056, {soot 363-1019 TDD . {214} Of?ce for Civil Rights, Region v1
3% - . 1301 Young Street, Suite 1169
. Dallas, TX T5202
OCT 1 7 2011


 

 

 

Privacy Director
CVS Careka
9501 E. Shea
Scottsdale, AZ 85260

Transaction Number: 1 

Dear libli?libmq lid q?Itmsumotc-i

On February 1, 2011, the Office for Civil Rights (OCR) received a complaint ?'om
alleging a violation of the Federal Standards for Privacy of Individually
Identi?able He t1 information andfor the Security Standards for the Protection of
Electronic Protected Health information (45 C.F.R. Parts 160 and 164, Subparts A, C, and 
E, the Privacy and Security Rules). Speci?cally, liblimiblimcl Ialleges CVS
Caremark impermissiny disclosed the protected health information of {bli?lxiblillicl an
individual with whom libiielialmici  has no patientfrovider relationship, when
CVS Caremark faxed the protected-health information of to him on Januaryr 31,
2011. This allegation could re?ect violations of 45 C.F.R. 164.502(a) and 

 

 

 

OCR enforces the Privacy and Security Rules and also enforces federal civil rights laws
which prohibit discrimination in the delivery of health and human services because of race,
color, national origin, disability and age. 

OCR notified CVS Caremark of the complaint on February 23, 2011 and
reviewed subsequent response. CVS conducted an internal investigation into the
complaint and acknowledged that libli?illtliilicl I prescription information was inadvertently
sent tolibiislxibmic? Irather than to the intended physician, libli?ilibmm I
Upon being noti?ed by OCR of the incorrect disclosure, CV8 Retail reassigned the
patient?s prescriptions to the correct and ran an audit of prescriptions assigned
to Iibli?libliilisl  to ensure they were assigned to the correct physician. CVS
provided additional HIPAA training to the employees of the involved store and issued a
letter of apology to libli53=ibli7li3l 

 

 

 

 

1 11123704 2

As part of our investigation, OCR further reviewed written assurance that CVS
Retail is irnplementing additional safeguards to prevent such future recurrences. In their
response to OCR dated April 3, 2011, CV8 explained that under the new process. the retail
pharmacies will no longer be able to search by prescriber name ?they will need to search
by DEA or NPI number. 011 September 28, 2011, the investigator contacted
by telephone. blieixibliilicl con?rmed that he had not received any further
incorrect faxes ?'onr CV3.

All matters raised by this complaint at the time it was ?led have now been resolved through
the voluntary compliance actions of CVS. Therefore, OCR is closing this case. 
determination as stated in this letter applies only to the allegations in this complaint that
were reviewed by OCR.

Under the Freedom of Inibrmation Act. it may be necessary tor OCR to release this
document and related correspondence and records upon request. in the event that OCR
receives such a request, we will seek to protect, to the extent provided by law, personal
information which, if released, would constitute an unwarranted invasion of privacy.

If you have any questions, contact Jamie Sorley, Investigator, at (214) 767-8908 (Voice),
(214) 767-8940 (TDD).

ely,

pit . Rouse
Regional Manager